Desktop-local PR code review

What this accomplishes

How to set up and use Miton Review to post inline comments on GitHub, GitLab, and Bitbucket pull requests.

Miton Review posts inline comments on your pull requests from your local machine. Your code never leaves your disk — not to Miton, not to a review API. The reviewer runs on your hardware and uses whichever model you have configured.

Current availability

This page documents behaviour verified in Miton development builds. Miton is still pre-release and is not publicly downloadable; invited beta users will receive a signed desktop build with automatic updates.

Before you start

• A Miton development build and an active project.
• A connected cloud or local model, plus any credentials or local runtime required by this task.

How it works

When a review is triggered, Miton spawns three parallel sub-agents:

1. Style reviewer — checks naming, formatting, and consistency with your project conventions
2. Security reviewer — checks for OWASP top 10, injection vectors, credential exposure, and insecure defaults
3. Test-coverage reviewer — checks whether new code paths have corresponding tests

Each sub-agent reports findings. The privacy gate scans every comment before it is posted and strips sensitive content (email addresses, tokens, internal hostnames, etc.). The inline comments are posted via the Git provider’s API using your OAuth token, which is stored in your OS keychain.

Supported providers

• GitHub (github.com and GitHub Enterprise)
• GitLab (gitlab.com and self-hosted)
• Bitbucket Cloud

Setup

1. Connect your Git provider

Open Settings → Integrations → Code review. Select your provider and click Connect. Miton opens an OAuth flow. Your token is stored in the OS keychain — Miton never stores it in plain text.

2. Configure strictness

Three presets are available per repository:

You can override the preset with per-repository custom instructions (see below).

3. Add per-repository custom instructions (optional)

In Settings → Integrations → Code review → [repository name] → Custom instructions, enter any project-specific guidance: naming conventions, off-limits patterns, frameworks to assume, etc.

Custom instructions are prepended to every review prompt for that repository.

Triggering a review

From the status bar

Open a session. Use the /review skill or type “Review the current PR.” Miton fetches the diff from your Git provider and starts the three-agent review.

Via the webhook receiver

The reviewer webhook URL is http://127.0.0.1:7744/webhook/reviewer/<provider>. You can configure your Git provider to send push webhook events to this endpoint (requires exposing the port, e.g. via a tunnel, for remote-hosted repos). On receiving the event, Miton starts a review automatically.

Via the pre-commit hook (opt-in)

Run the installer from Settings → Integrations → Code review → Pre-commit hook → Install. Miton adds a .git/hooks/pre-commit entry that triggers a lightweight review before every commit. The pre-commit review uses the Lenient preset and blocks the commit only on high-confidence security findings.

Reading the results

Miton posts inline comments directly on the PR. Each comment includes:

• The specific finding
• The severity (informational / warning / blocking)
• A suggested fix, where one exists

You can see a summary of all findings in Sessions → [session name] → Review summary.

Privacy

• The diff is fetched from your Git provider using your own OAuth token
• The diff is passed to your configured model (not to Miton)
• No code is sent to Miton servers
• The privacy gate strips sensitive content before any comment is posted
• The OAuth token is stored in the OS keychain

What success looks like

How to set up and use Miton Review to post inline comments on GitHub, GitLab, and Bitbucket pull requests. The result remains attached to the active project when you move to another workspace.

Common failures and recovery

“No diff found” — check that you have an open PR on the configured provider. Miton reviews PRs, not local branches without a remote PR.

“Provider authentication failed” — go to Settings → Integrations → Code review and reconnect. Your token may have expired.

Comments are not appearing — check that the OAuth token has pull_request:write (GitHub) or api (GitLab) scope. The scope required is shown in the OAuth flow.

Related next action

Continue with your first project or choose the next task from Docs.